Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

supply-chain: [tool.uv] exclude-newer = "7 days" doesn't enforce a 7-day quarantine

Aperta Adatta ai principianti
  • Qualcosa non va?
#33 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
78/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Tranquilla
Stack tecnologico
python
Ambito
build-system, security

Direzione di ricerca

Apri pyproject.toml e ispeziona l'impostazione exclude-newer in [tool.uv] e il relativo commento inline. Conferma il formato relativo accettato in base al comportamento attuale di uv, aggiorna l'impostazione e adegua il commento di conseguenza. Quindi esegui uv pip compile pyproject.toml -o /tmp/test.txt e ispeziona la versione risolta di GitPython. .github/dependabot.yml e i livelli minimi di sicurezza delle dipendenze sono esplicitamente fuori ambito.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Problem

pyproject.toml declares:

```toml
[tool.uv]

Exclude packages uploaded to PyPI more recently than ~30 days ago.

This gives the community time to catch supply-chain issues before they land here.

Bump this date when you intentionally need a newer release.

exclude-newer = "7 days"
```

This is intended as a 7-day supply-chain quarantine: deny the resolver from pulling packages uploaded in the last 7 days, so newly-compromised or malicious releases (think the xz incident, but on PyPI) have a window to be detected before reaching CoDA.

Empirically, the quarantine is a no-op. While preparing #32 (the GitPython / python-multipart CVE bumps), uv pip compile happily resolved to packages uploaded ~36 hours earlier:

```
$ grep -E "^(gitpython|python-multipart)" /tmp/requirements.test.txt
gitpython==3.1.49 # uploaded 2026-05-06 21:58 UTC
python-multipart==0.0.27 # uploaded 2026-05-06 21:56 UTC
```

If the cooldown were enforced, both should have been excluded.

Root cause (suspected)

The value "7 days" doesn't match uv's accepted format for exclude-newer. uv expects either:

  • An RFC 3339 timestamp: `"2026-05-01T00:00:00Z"`
  • A relative offset in compact form: `"7d"`, `"2w"`, `"1mo"`

The string `"7 days"` (with a space, plural noun) is most likely silently ignored, falling back to no cutoff. (Worth confirming against current uv source; the failure mode is silent acceptance, not a resolve error.)

Why this matters

The comment frames the quarantine as a deliberate defense against community-undetected supply-chain compromises. With it broken:

  • The App container — which holds rotated workspace PATs and access to all repos under `~/projects/` — is exposed to any newly-published vulnerable or malicious release at deploy time.
  • We have no resolve-time backstop if Dependabot's cooldown (`.github/dependabot.yml`'s `cooldown.default-days: 7`) is the only quarantine in the loop.
  • The two are meant to compose: Dependabot suppresses bump PRs; `exclude-newer` suppresses resolves on direct `uv pip compile` runs (e.g., a maintainer regenerating the lockfile locally).

Fix

Replace the value with one of:

```toml
exclude-newer = "7d"
```

or, for stronger reproducibility, an absolute date that's bumped per release:

```toml
exclude-newer = "2026-04-30T00:00:00Z"
```

The comment also says "~30 days ago" but the value is "7 days" — the inline comment is stale relative to the value, which adds to the confusion. Reconcile both.

Verification

After the fix, regenerate the lockfile against a recently-published package and confirm uv refuses to resolve to it:

```
$ uv pip compile pyproject.toml -o /tmp/test.txt
$ grep gitpython /tmp/test.txt
gitpython==3.1.47 # quarantined to the pre-cutoff version
```

(Once #32 lands, this verification target will move forward in time.)

Out of scope here

  • Any change to security floors in pyproject.toml — those belong in #32 / the dep-bump flow.
  • Reconfiguring Dependabot — `.github/dependabot.yml`'s cooldown is a separate concern (and is parsing correctly, since Dependabot's PR list shows the expected suppressed bumps).

This issue and its description were written by Isaac.

Lingua principale
Python
Stelle
40
Fork
11
Merge medio
1m
PR unite (30g)
1

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di databrickslabs/coding-agents-databricks-apps

Tutte le issue di databrickslabs/coding-agents-databricks-apps

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.